by Jeff McJunkin
Greetings! Those of you who attended ShmooCon this year may have noticed a challenge from SANS included in your Shmoo bags. If you didn't attend and you want to walk through the challenge yourself for some fun, I'd recommend you look at the challenge description and avoid reading the official write-up at the end of this post until you've looked at the challenge itself.
We're always excited to see the new ways our participants will solve our challenges, and the Shmoo crowd certainly didn't disappoint! We had lots of great entries which were a pleasure to read through.
As written in the original description, the first ten participants who solved the challenge will receive a free SANS NetWars t-shirt. If you see your name below, you will also have an email sent to orchestrate the details of getting your prize to you.
Accordingly, here are those ten winners!
[Editor's Note: Every year for eleven seasons now, SANS creates a Holiday Hack challenge for you to build your skills with real-world infosec tools and techniques, all the while having some good holiday-inspired fun, for everyone to participate in, no charge at all. If you haven't checked out our most recent SANS Holiday Hack Challenge, you should definitely read through it. This years' challenge was written by Ed Skoudis and Josh Wright, with support from Tom Hessman and the vocal stylings of James Lyne. We'll keep the challenge itself, the target servers, and the file system image available for as long as possible, so you can continue to work through it, either on your own, or referencing the official answers cited below. Have fun!!! Following immediately below is our official announcement of winners and answers. --Ed.]
Lynn Cratchit emerged from the rather toasty
By Ed Skoudis and Josh Wright
Josh Wright and I were working on a project recently which involved a target machine with a really restricted shell environment. I'm not talking about a mere rbash with some limits on the executables we could access, but instead a shell so restricted we could not run any binaries at all, save for the shell itself. No ls no cat no netcat we could access very little. It was some sort of ghastly chroot specter.
Still, Josh and I wanted to explore the target machine as much as we could given these shell restrictions. Of course we could have tried escaping our restricted shell (as Doug Stilwell describes in more detail here) and even doing privilege escalation, but before that, we wanted to just look around. Thankfully, we had many shell built-in capabilities we could rely on.
For the uninitiated, shell built-ins are
By Jeff McJunkin
Ladies. Gentlemen. Tim Medin. May I have your attention please? I'm excited to say that the time to select our SANS Brochure Challenge winners has come! If you'll remember, we started this challenge back in late July and we did something very new - we made the challenge start from within the pages of the actual SANS brochures!
We had some FABULOUS write-ups submitted, and we'd like to thank everyone who took part in the challenge. I was happily surprised to see participants using so many ways to approach the pieces of the challenge. Many folk found even easier ways than what was intended!
So, without delaying any further, I'd like to introduce our categories and winners...
For the best technical write-up, after long consideration between the Counter Hack judges, we'd like to award Dave Lassalle with
Over the past couple of weeks, we've been running the SANS Pen Test Hackfest Twitter Contest. I'm delighted to announce the winner. The contest was simple and fun -- just submit a picture of yourself via Twitter with SANS coins, SANS books, or other SANS shwag, and we'll choose a winner at ramdom. We've had some great entries... you guys are a creative group! If you want to see them all, just do a Twitter search for the hashtag #SANSHackfest.
The winner will receive free entry to the 2-Day Summit associated with our November 13 through 20 Pen Test Hackfest training event in Washington DC. We throw everything we've got into this extra special event, including:
- Two days of amazing, in-depth talks by leading minds of the industry, including the authors of some of the best pen test tools on the planet, including SET,